Authorization bypass via unscoped datasource action checks

Incorrect authorization in Grafana and Grafana Enterprise 11.1.0 and 11.1.2 allows remote authenticated users to invoke protected plugin routes. The datasource proxy route evaluator checks a required action without constraining that permission to the requested datasource UID. An account must already have query access to the target datasource and the associated permission for another datasource; the vendor has not identified the route-specific data changes or service interruption available afterward.